Earlier quoted context omitted.
This comment together with the ars article just gave me the biggest 90s flashback ever... really, so little has changed in over a decade??? Next up they just HAVE to show us how to setup our own quakeworld or UnrealTournament'99 or Quake3 server! ;-)
Well, rlpb's fundamental point is quite valid: Vendors have done tremendous work in making an OS secure out-of-the-box. I remember exposing default installations to the public Internet a decade or more ago and watching them get compromised in minutes, if not seconds. Virtually every platform required hardening, and the only thing protecting most ordinary users was the fact that exposure was intermittent via expensive…
It was an amazingly short sighted move, but such things were typical back then. And it's only from learning the hard way that we've managed to get to the stage we're at now.
However I think it's often forgotten that servers need a different set of security profiles depending on the server's role and where it is sat. For example, a webserver sat behind a hardware load balancer wouldn't necessarily need much SSH protection as the webfarm HTTP traffic should be on a different VLAN to the internal systems administration traffic (which in turn, would be another different VLAN to the company's staff VLAN). So it would be almost impossible to get access to an OpenSSH log in, let alone attack it. Where as most consumer VPS solutions put all their customer servers in the DMZ, which means it's up to the customer to provide software preventions to harden against access that would normally be protected with a complex hardware solution in more professional / clustered set ups.
And this is why you can't fully trust default configs; there simply is no "one size fits all" solution so package maintainers instead opt for the best compromises.